>>
LATEST DEVELOPMENT OF HONGKONG POST E-CERT SERVICES
Contents
- HONGKONG POST CA
- PUBLIC KEY INFRASTRUCTURE (PKI)
- HONGKONG POST E-CERT SERVICES
- SUBMISSION OF CERTIFICATE SIGNING REQUEST (CSR) FOR E-CERT (SERVER)
- CENTRAL KEY GENERATION SERVICE
FOR E-CERT
- TECHNICAL ISSUES
- REVOCATION OF CERTIFICATES
- DELETION AND RECOVERY ISSUES
- BACK-UP AND TRANSFER OF CERTIFICATE
- E-CERT FOR SMART ID CARD / CARD
READER
- RENEWAL OF E-CERT (PERSONAL)
- E-CERT FILE CARD
A. HONGKONG POST
CA
- WHY SHOULD I CHOOSE HONGKONG
POST CA AS MY CERTIFICATION AUTHORITY?
- ARE THERE LAWS IN HONG KONG
REGULATING DIGITAL SIGNATURES?
- WHAT IS THE MEANING OF "RELIANCE
LIMIT" FOR THE E-CERT CERTIFICATE?
- RETIREMENT OF SUPERSEDED CERTIFICATION
AUTHORITY SYSTEM
- HONGKONG POST CERTIFICATION AUTHORITY SUB CA ROLLOVER
- WHAT WILL BE THE IMPACTS TO E-CERT SUBSCRIBERS AS A RESULT OF THE SUB CA ROLLOVER?
B. PUBLIC KEY INFRASTRUCTURE
(PKI)
- WHAT IS ENCRYPTION ?
- WHAT IS PUBLIC KEY CRYPTOGRAPHY
AND HOW DOES IT WORK?
- WHAT IS A CERTIFICATION AUTHORITY
(CA)?
- WHAT IS A DIGITAL CERTIFICATE?
- WHAT IS THE HONGKONG POST E-CERT
CERTIFICATE?
- WHAT IS A DIGITAL SIGNATURE
AND HOW DOES IT WORK?
- WHAT IS HASH FUNCTION/VALUE?
- WHAT IS S/MIME ?
- WHY IS/ARE THERE AN S/MIME .P7M
AND/OR S/MIME .P7S ATTACHMENT TO MY E-MAIL?
- WHAT IS A SECURE SOCKET LAYER
(SSL)?
- HOW DO I SEND A SIGNED AND
ENCRYPTED E-MAIL ?
- HOW CAN I OBTAIN SOMEONE ELSE'S
DIGITAL CERTIFICATE (WITH PUBLIC KEY EMBEDDED)
IN ORDER TO SEND HIM/HER AN ENCRYPTED E-MAIL?
- HOW DO I READ THE ENCRYPTED
E-MAILS I RECEIVE?
- HOW DO I VERIFY THE DIGITAL
SIGNATURES ON SIGNED MESSAGES I RECEIVE?
- HOW DO I KNOW IF THE E-MAIL
I HAVE RECEIVED IS SIGNED OR ENCRYPTED?
- CAN I SEND SECURE E-MAIL TO
SOMEONE WHO DOES NOT HAVE A DIGITAL CERTIFICATE?
C. HONGKONG POST
E-CERT SERVICES
- DOES HONGKONG POST E-CERT SUPPORT
CHINESE CHARACTERS?
- DOES HONGKONG POST E-CERT SUPPORT
ELLIPTIC CURVE CRYPTOSYSTEM (ECC)?
- DOES HONGKONG POST E-CERT SUPPORT
OBJECT SIGNING AND AUTHENTICODE?
- HOW STRONG IS HONGKONG POST
E-CERT (SERVER)?
- CAN HONGKONG POST E-CERT CERTIFICATES
BE USED INTERNATIONALLY?
- CAN I USE MY E-CERT WITH HOTMAIL
OR OTHER SIMILAR E-MAIL SERVICES ?
- WHAT HAPPENS AFTER MY HONGKONG
POST E-CERT CERTIFICATE EXPIRES?
- HOW MANY HONGKONG POST E-CERT
CERTIFICATES CAN I APPLY FOR?
- HOW MUCH DOES A HONGKONG POST
E-CERT CERTIFICATE COST?
- FOR HOW LONG ARE HONGKONG POST
E-CERT CERTIFICATES VALID?
- CAN I CHANGE THE INFORMATION
ON A CERTIFICATE?
- WHAT ARE THE KEY LENGTHS SUPPORTED
BY HONGKONG POST CA?
- WHY DOES MY BROWSER FIRST HAVE
TO ACCEPT THE HONGKONG POST ROOT CA CERTIFICATE?
- WHERE DO I DOWNLOAD THE PUBLIC
KEY OF THE HONGKONG POST ROOT CA CERTIFICATE,
AND HOW DO I INSTALL IT IN THE BROWSER?
- HOW DO I RETRIEVE A LOST OR
ACCIDENTALLY DELETED E-CERT?
- WHY IS IT IMPORTANT TO MAKE
A BACK-UP COPY OF MY HONGKONG POST E-CERT CERTIFICATE?
- CAN I USE ONE HONGKONG POST
E-CERT CERTIFICATE FOR MULTIPLE E-MAIL ADDRESSES?
- WHAT ARE THE AUTHENTICATION
PROCEDURES FOR HONGKONG POST E-CERT CERTIFICATES?
- WHY IS HONGKONG POST ISSUING
DIGITAL CERTIFICATES TO MINORS?
- CAN I SEARCH HONGKONG POST
E-CERT (ENCIPHERMENT) CERTIFICATE FROM THE HONGKONG
POST DIRECTORY SERVER ?
- WHERE I CAN FIND THE TERMS
AND CONDITIONS GOVERNING THE USE OF HONGKONG
POST E-CERT CERTIFICATES?
- HOW TO SEARCH IN NETSCAPE THE
CERTIFICATE OF OTHER PEOPLE WHO HAS TWO OR MORE
E-CERT WITH THE SAME EMAIL ADDRESS?
- WHY MUST AN APPLICANT FOR E-CERT
COMPLETE THE IDENTITY VERIFICATION PROCESS IN
PERSON AT A POST OFFICE?
- CAN AN APPLICANT VISIT A POST
OFFICE DURING LUNCH BREAK, OVER WEEKEND OR ON
SUNDAY TO COMPLETE THE APPLICATION PROCESS?
- IF AN APPLICANT HAS QUESTIONS
OF INSTALLING AN E-CERT, HOW CAN HE/SHE SEEK
HELP?
- IS IT A PROPER ARRANGEMENT
FOR HONGKONG POST TO DELIVER THE E-CERT FLOPPY
DISK / E-CERT FILE CARD TO AN APPLICANT BY POST?
- CAN AN E-CERT BE USED ON COMPUTERS
RUNNING LINUX OR MAC OPERATING SYSTEMS?
D. SUBMISSION OF CERTIFICATE SIGNING REQUEST (CSR) FOR E-CERT (SERVER)
- WHAT
IS A CERTIFICATE SIGNING REQUEST (CSR)?
- HOW DO I GENERATE A CERTIFICATE SIGNING REQUEST (CSR)?
- WHAT SHOULD I PASTE INTO THE CERTIFICATE SIGNING REQUEST (CSR) TEXT BOX DURING
THE E-CERT (SERVER) CSR SUBMISSION PROCESS?
- WHAT SHOULD I DO IF I DID NOT DOWNLOAD MY E-CERT (SERVER) IN THE LAST STEP OF
THE CERTIFICATE SIGNING REQUEST (CSR) SUBMISSION
PROCESS?
E. CENTRAL KEY GENERATION
SERVICE FOR E-CERT
- WHAT IS CENTRAL KEY GENERATION
SERVICE AND HOW DOES IT WORK?
- IS CENTRAL KEY GENERATION SERVICE
APPLICABLE TO ALL TYPES OF E-CERT?
- ARE THERE ANY PROTECTIVE MEASURES
TO SAFEGUARD THE PRIVATE KEY OF THE E-CERT CREATED
UNDER THE CENTRAL KEY GENERATION SERVICE?
- WHICH VERSIONS OF INTERNET BROWSER
CAN THE E-CERT FILE GENERATED UNDER THE CENTRAL
KEY GENERATION SERVICE WORK WITH?
- IS THERE ANY TOOL OR PROGRAM
THAT CAN BE USED TO CHANGE THE PASSWORD OF THE
E-CERT FILE?
- IS THERE ANY RESTRICTION IN
USING THE "CHANGE PASSWORD PROGRAM" SOFTWARE?
- HOW DOES THE "CHANGE PASSWORD
PROGRAM" WORK?
F. TECHNICAL ISSUES
- SYSTEM REQUIREMENTS
- HOW DO I KNOW THAT MY HONGKONG
POST E-CERT CERTIFICATE IS PROPERLY INSTALLED?
- WHAT SHOULD I DO IF MY PIN DOES
NOT APPEAR TO WORK?
- WHY I AM GETTING AN 'EXPIRED
CERTIFICATE' MESSAGE SHORTLY AFTER DOWNLOADING
IT?
- I HAVE DELETED MY NETSCAPE NAVIGATOR
AND INSTALLED THE LATEST VERSION. HOW DO I REINSTALL
MY DIGITAL CERTIFICATE?
- HOW DO I KNOW I AM CONNECTED
TO A SECURE SERVER ?
- HOW DO I GET 128-BIT / FULL-STRENGTH
SESSIONS?
- WHAT DOMAIN NAME DO I USE ON
MY SERVER CERTIFICATE REQUEST?
- WHICH FIELD INSIDE THE E-CERT
(ENCIPHERMENT) CERTIFICATE CONTROLS THE USAGE
PURPOSE OF THE KEY PAIR?
- THE KEY PAIR OF THE E-CERT
(ENCIPHERMENT) WILL BE USED FOR ENCRYPTION AND
DECRYPTION OF ELECTRONIC RECORDS. HOW DOES THIS
KEY PAIR WORK?
- USING E-CERT IN THE CRYPTO
TOOLS SOFTWARE
G. REVOCATION OF
CERTIFICATES
- HOW DO I REVOKE MY HONGKONG
POST E-CERT CERTIFICATE?
- WHY DO I NEED TO REVOKE MY CERTIFICATE
BEFORE IT EXPIRES?
- HOW CAN I VERIFY THE STATUS
OF MY REVOKED CERTIFICATE?
H. DELETION AND
RECOVERY ISSUES
- IS THERE ANY WAY TO RECOVER
MY HONGKONG POST E-CERT CERTIFICATE IF MY HARD
DRIVE HAS CRASHED?
- WHAT SHOULD I DO IF MY COMPUTER
HAS BEEN STOLEN TOGETHER WITH MY CERTIFICATE?
- SHOULD I DELETE MY EXPIRED OR
REVOKED E-CERT?
I. BACK-UP AND TRANSFER
OF CERTIFICATE
- HOW DO I SAVE A BACK-UP COPY
OF MY DIGITAL CERTIFICATE?
- HOW DO I TRANSFER MY DIGITAL
CERTIFICATE TO A NEW COMPUTER?
J. E-CERT
FOR SMART ID CARD / CARD READER
K. RENEWAL OF E-CERT
(PERSONAL)
- WHY SUBSCRIBERS OF E-CERT ON
SMART ID CARD HAVE NOT RECEIVED THE RENEWAL
NOTICE UPON THE EXPIRY OF E-CERT?
- WHAT IS THE DIFFERENCE BETWEEN
"EXTENSION OF SUBSCRIPTION PERIOD"
AND "RENEWAL"?
- HOW CAN SUBSCRIBERS RENEW THEIR
E-CERT?
- WHAT IS THE VALIDITY PERIOD
OF THE RENEWED E-CERT ON SMART ID CARD? WHAT
IS THE RENEWAL FEE?
- CAN I PAY HK$150 FOR 3-YR SUBSCRIPTION
FEES IN ONE GO?
- WHEN SUBMITTING A RENEWAL APPLICATION,
WILL THE SUBSCRIBERS OF E-CERT ON SMART ID CARD
BE ISSUED A NEW PIN ENVELOPE? IF SUBSCRIBERS
REQUEST FOR A BACK-UP FLOPPY DISK OR A E-CERT
FILE CARD, DO THEY NEED TO PAY EXTRA FOR THE
BACK-UP FLOPPY DISK / E-CERT FILE CARD?
- UPON RECEIPT OF THE NEW PIN
ENVELOPE AND FLOPPY DISK / E-CERT FILE CARD
FOR THE RENEWED E-CERT ON SMART ID CARD, CAN
THE SUBSCRIBER THROW AWAY THE OLD PIN ENVELOPE
AND FLOPPY DISK / E-CERT FILE CARD?
- CAN I RENEW MY E-CERT ON SMART
ID CARD BUT HAVE IT LOADED ONTO FLOPPY DISK
/ E-CERT FILE CARD ONLY INSTEAD OF SMART ID
CARD?
- CAN THE RENEWED E-CERT BE STORED
TOGETHER WITH THE EXISTING E-CERT THAT WAS STORED
IN THE SMART ID CARD?
- I HAVE TWO E-CERT ON HAND BUT
ONLY THE SMART ID CARD ONE WAS EXPIRED. CAN
I LOAD THE OTHER E-CERT (PERSONAL) FROM FLOPPY
DISK ONTO MY SMART ID CARD BY MYSELF?
- WHAT ARE THE CHANNELS FOR ENQUIRY?
L. E-CERT
FILE CARD
A. Hongkong Post CA
A-1 Why
should I choose Hongkong Post CA as my Certification
Authority?
Hongkong Post Certification Authority is a recognised
Certification Authority under the Electronic Transactions
Ordinance, CAP 553. The Hongkong Post e-Cert certificates
are recognised certificates issued by the Postmaster
General of the Hong Kong Post Office in accordance
with the requirements of the Electronic Transactions
Ordinance and Code of Practice for Recognised
Certification Authority. In addition, Hongkong
Post CA conducts a strict authentication process
for the verification of the identity of the subscribers
providing the infrastructure for secure e-commerce.
Details of authentication procedures are available
from the Hongkong Post Certification Practice
Statement (CPS) at www.hongkongpost.gov.hk
A-2 Are
there laws in Hong Kong regulating digital signatures?
Yes, the Electronic Transactions Ordinance (Cap
553), was first enacted in January 2000 and amended
in July 2004. The Ordinance is available for viewing
at http://www.ogcio.gov.hk/eng/eto/eeto.htm
A-3 What
is the meaning of "Reliance Limit" for the e-Cert
certificate?
Reliance Limit means the monetary limit specified
for reliance on a recognised certificate. The
relevant sections of the Electronic Transactions
Ordinance are Sections 41 and 42.
A-4 Retirement
of Superseded Certification Authority System
In January 2004, Hongkong Post completed the
Certification Authority (CA) system upgrade exercise,
and the functions of the original CA system
(OCA)
operating under the OCA
roots "Hongkong Post Root CA" and "Hongkong
Post e-Cert CA" were taken over by the
new CA system (NCA) operating under three NCA
roots "Hongkong Post Root CA 1", "Hongkong Post e-Cert CA 1" and "Hongkong Post e-Cert CA 1 - 10".
Since 1 February 2004, the NCA has been issuing
types of recognized
certificates and the OCA has ceased to issue
recognized certificates. As all recognized certificates
issued by the OCA have a validity period of one
year, all such certificates have expired by 1
February 2005, and therefore no recognized certificates
issued by the OCA are still valid at present.
On 1 April 2005, the OCA retired and ceased to
issue CRLs under the OCA roots "Hongkong
Post Root CA" and "Hongkong Post e-Cert
CA". The
last CRL of the OCA was issued on 31 March 2005.
The retirement of the OCA does not affect the
existing operation (including the publication
of CRLs) of the NCA and services of the Hongkong
Post Certification Authority. All recognized certificates
and CRLs issued under both the OCA and NCA are
still accessible at the existing repository.
A-5 Hongkong Post Certification Authority Sub CA Rollover
The existing Sub CA "Hongkong Post e-Cert CA 1" that has been used to sign the Recognized Certificates since 15 May 2003, will be expired on 15 May 2013. In order to continue issuing Recognized Certificates with the maximum validity period of 3 years, Hongkong Post completed the Sub CA "Hongkong Post e-Cert CA 1" Rollover on 26 February 2010.
With the completion of Sub CA rollover, the Sub
CA "Hongkong
Post e-Cert CA 1" ceases to issue Recognized Certificates, and the new Sub CA "Hongkong Post e-Cert CA 1 - 10" is used to issue Recognized Certificates. Both Sub CA are continuing to perform
revocation of certificates issued by them and
issuing CRLs until the end of the lifetime
of the respective Sub CA. The e-Cert subscription
and revocation procedures will remain unchanged
after the Sub CA rollover.
A-6 What will be the impacts to e-Cert subscribers as a result of the Sub CA
rollover?
Subscribers with Recognized Certificates issued
after the Sub CA rollover may need to install
the new Sub CA "Hongkong Post e-Cert CA 1 - 10"
to their applications, such as web browser or
web
server,
to recognize
the
new
Sub CA.
The e-Cert Control Manager ("eCM")
software (version 2.1.8 Build 7) is released
to support both the Sub CA "Hongkong Post e-Cert CA 1" and "Hongkong Post e-Cert CA 1 - 10". Subscribers with e-Cert (Personal) issued by the new Sub CA have to install
or upgrade to this latest version of eCM in order
to continue using their e-Cert on Smart ID Card.
B. Public Key Infrastructure (PKI)
B-1 What
is Encryption ?
The concept of encryption is simple: a message
is converted from the original (plain text) into
another, incomprehensible form (cipher text) by
means of a specified procedure (algorithm) and
a key. The same key can then be used to decrypt
the message to its original form. Knowledge of
the encryption key is necessary to carry out decryption.
With the encryption techniques in use today, the
security of the system is critically dependent
on the length of the key used for the encryption.
As encryption algorithms are publicly available,
it is through the complexity (i.e., its length)
and the secrecy of the key that the strength of
the encryption can be assured.
B-2 What
is Public Key Cryptography and how does it work?
Public Key Cryptography or Asymmetric Cryptography
forms the basis of digital signatures and Public
Key Infrastructure. This technique makes use of
a pair of mathematically related, but different
keys - a private key and a public key. The private
key is kept secret and is only accessible to its
owner; the public key is intended for wide distribution.
If one key is used to encrypt a message, then
only the other key in the pair can be used to
decrypt it. The public key can be used to verify
a message signed with the private key, or to encrypt
messages that can only be decrypted using the
private key.
B-3 What
is a Certification Authority (CA)?
A Certification Authority (CA) is an organisation
that issues independently authenticated digital
certificates for use by individuals or organisations.
B-4 What
is a digital certificate?
A digital certificate is an electronic file issued
and digitally signed by a Certification Authority,
vouching for the identity of the certificate holder.
B-5 What
is the Hongkong Post e-Cert certificate?
The Hongkong Post e-Cert certificate is a digital
certificate that is issued, signed and managed
by Hongkong Post Certification Authority (CA)
and is X.509 v.3 compliant. Hongkong Post CA offers
three different types of digital certificates:
- Hongkong Post e-Cert (Personal) Certificates:
these are used in browsers and e-mail programmes
so that users can prove their identity to third
parties;
- Hongkong Post e-Cert (Organisational) Certificates:
these are used by organisations, associations
or Government departments which wantto issue
an organisation-based certificate to their members/employees
to conduct secure message transmission; and
- Hongkong Post e-Cert (Server) Certificates:
these are to authenticate servers to users,
thereby making it possible to communicate in
Secure Socket Layer (SSL) messages.
- Hongkong Post e-Cert (Encipherment) Certificates
: there are used for encryption and decryption
of message for confidentiality purpose only.
This type of certificate is not to be used for
message signing like e-Cert (Personal) and e-Cert
(Organisational).
B-6 What
is a Digital Signature and how does it work?
A digital signature is a unique string of bits
that is separately generated for each message,
'signed' by the private key of the sender, and
appended to the message prior to being forwarded
to the intended recipient. By verifying the signature
through using the public key of the sender, the
receiver will be able to confirm the identity
of the sender and be certain that the message
has not beenaltered during transmission. In this
way, digital signatures provide:
- Authentication : proof of identity of the
parties to an electronic transaction;
- Integrity: assurance that the contents of
a message have not been tampered with or modified;
- Non-repudiation: proof of agreement to the
terms of the transaction and prevention of denial
of commitment.
B-7 What
is Hash Function/Value?
The technique of the hash function is to compute
a short digest of a fixed length from any given
message that represents the message content. The
hash function makes it impossible to revert to
the original message and computationally difficult
to find any two messages that hash to the same
result. MD5 and SHA-1 are common hash algorithms.
B-8 What
is S/MIME ?
S/MIME (Secure/ Multipurpose Internet Mail Extensions)
is a de facto standard for sending secure
e-mail over the Internet. MIME is the industry
standard format for electronic mail, which defines
the structure of the message's body. S/MIME adds
a secure feature to the MIME standard. E-mail
applications that support S/MIME add digital signatures
and encryption capabilities to that format. Standardisation
of the secured message's format allows users to
conduct private and authenticated communications,
independent of the e-mail software they use, as
long as this software is S/MIME compatible. You
and your recipient must have public key certificates
and S/MIME compatible e-mail applications in order
to send and receive secured e-mail.
B-9 Why
is/are there an S/MIME .p7m and/or S/MIME .p7s
attachment to my e-mail?
S/MIME is the secure e-mail protocol and .p7m
contains the encrypted message while .p7s is the
digital signature file. If this is received as
an attachment, there are 2 possibilities :-
- You may be using a web-based e-mail account.
It is suggested that you change your e-mail
account to a non web-based account;
- You may be using an e-mail client which is
not S/MIME compatible and will not be able to
verify the attached signature. It is suggested
that you upgrade your e-mail client to the latest
version (e.g., Microsoft Outlook 98/2000) or
use another S/MIME compatible mail programme
(e.g., Microsoft Outlook Express 5 or Netscape
Messenger 4.7 or above).
B-10 What
is a Secure Socket Layer (SSL)?
The SSL handshake protocol was developed by Netscape
Communications Corporation to provide security
and privacy over the Internet. The Protocol supports
server and client authentication. The SSL Protocol
is application independent, allowing protocols
like HTTP (Hyper Text Transfer Protocol), FTP
(File Transfer Protocol), and Telnet to be layered
on top of it transparently. The SSL Protocol is
able to negotiate encryption keys, as well as
to authenticate the server before data are exchanged
by the higher-levelapplication. The SSL Protocol
maintains the security and integrity of the transmission
channel by using encryption, authentication and
session keys.
B-11 How
do I send a signed and encrypted e-mail ?
For two parties to exchange signed and encrypted
e-mail it is necessary that:
- both parties correspond through
S/MIME compatible e-mail programmes, AND
- both parties have a digital
certificate.
If the above conditions are fulfilled, the sender
of a message can sign and encrypt messages with
the options to "sign" and/or "encrypt" in his/her
mail programme.
B-12 How
can I obtain someone else's digital certificate
(with public key embedded) in order to send him/her
an encrypted e-mail?
To enable you to send an encrypted e-mail,
- you need to ask your recipient to send you
a signed e-mail and save the certificate in
your address book; or
- find a digital certificate from Hongkong Post's
online e-Cert repository (directory) either
by name or e-mail address, and then download
your recipient's e-Cert.
B-13 How
do I read the encrypted e-mails I receive?
If an e-mail message has been properly encrypted,
i.e., with the public key corresponding to your
private key, the encrypted message will be automatically
decrypted for you (after you have entered your
password for activating your private key) by your
S/MIME compatible e-mail application and displayed
to you as plain text.
B-14 How
do I verify the digital signatures on signed messages
I receive?
If your sender has included his/her public key
certificate in the signed message, the digital
signature on the message will be automatically
verified by your S/MIME compatible e-mail application.
In Netscape Messenger, a security icon saying
"Signed" will be shown on the upper right corner
of the message.
B-15 How
do I know if the e-mail I have received is signed
or encrypted?
For Netscape Messenger users: security enhanced
messages have an icon in the upper-right corner,
indicating that the message has been "signed",
"encrypted" or "signed and encrypted".
B-16 Can
I send secure e-mail to someone who does not have
a digital certificate?
No, you cannot. In order to encrypt the e-mail
message that you want to transmit, you will need
to access the public key of the intended recipient.
If the recipient is not in possession of a digital
certificate, he/she will not have a public key.
However, you can digitally sign messages to recipients
whose e-mail applications support S/MIME. They
will be able to verify your signature on the messages.
C. Hongkong Post e-Cert Services
C-1 Does
Hongkong Post e-Cert support Chinese characters?
Currently, the technology adopted by Hongkong
Post does not support Chinese characters. Hence,
for the present,all Hongkong Post e-Cert certificates
will be issued in English only.
C-2 Does
Hongkong Post e-Cert Support Elliptic Curve Cryptosystem
(ECC)?
ECC is not supported for the time being.
C-3 Does
Hongkong Post e-Cert Support Object Signing and
Authenticode?
Object signing and authenticode are not supported
for the time being.
C-4 How
strong is Hongkong Post e-Cert (Server)?
Hongkong Post e-Cert (Server) is as strong as
you want it to be. If you generate a 1024-bit
Certificate Signing Request (CSR) and submit it,
we will sign it and you'll receive a 1024-bit
certificate. Similarly, if you generate a 512-bit
CSR, then you'll receive a 512-bit certificate.
C-5 Can
Hongkong Post e-Cert Certificates be used internationally?
Hongkong Post e-Cert certificates are X.509 v3
compliant (an international standard) and can,
therefore, be used internationally.
C-6 Can
I use my e-Cert with Hotmail or other similar
e-mail services ?
This is not possible. Web-based e-mail services
such as Hotmail and Yahoo are not S/MIME compatible.
For details, please see heading under S/MIME below.
C-7 What
happens after my Hongkong Post e-Cert certificate
expires?
When a Hongkong Post e-Cert certificate expires,
it can no longer be used for secured e-mail. You
should re-apply for a new e-Cert certificate.
C-8 How
many Hongkong Post e-Cert certificates can I apply
for?
As many as you like. There is no limit to the
number of Hongkong Post e-Cert certificates you
can apply for.
C-9 How
much does a Hongkong Post e-Cert certificate cost?
The subscription fees for the four types of Hongkong
Post e-Cert certificates are:
| Type of Certificate |
Annual Fee
(HK$) |
| Personal |
$50 |
| Organisational |
$150 ($50 for
a first-time subscriber)
(plus an administration fee of $150 per application)
|
| Server |
$2,500 |
| Encipherment |
$150
(plus an administration fee of $150 per application) |
C-10 For
how long are Hongkong Post e-Cert certificates
valid?
- The validity period of Hongkong Post e-Cert(Personal)
and Hongkong Post e-Cert (Personal) for Smart
ID Card is 3 years.
- The validity period for e-Cert(Organizational),
e-Cert(Encipherment) and e-Cert(Server) is 1
or 2 years.
C-11 Can
I change the information on a certificate?
A digital certificate, once generated, cannot
be changed. If you have changed any information
on the certificate such as your name or your e-mail
address, you must apply for a new certificate.
You should also revoke your existing certificate.
C-12 What
are the key lengths supported by Hongkong Post
CA?
Hongkong Post CA supports certificates of any
key length up to 2048 bits. Hongkong Post CA root
certificates have 2048-bit keys.
C-13 Why
does my browser first have to accept the Hongkong
Post Root CA certificate?
The Hongkong Post Root CA certificate is not
pre-installed in standard browsers. This means
that you will have to load the Hongkong Post Root
CA certificate into your browser yourself. You
need this root certificate to validate a certificate
issued by Hongkong Post CA.
C-14 Where
do I download the public key of the Hongkong Post
Root CA certificate, and how do I install it in
the browser?
The Hongkong Post CA Root certificates are available
for downloading under the heading of "Download".
C-15 How
do I retrieve a lost or accidentally deleted e-Cert?
If you lose your Hongkong Post e-Cert certificate,
you must revoke your certificate immediately.
In case you have accidentally deleted your certificate,
you simply need to import the certificate from
your back-up copy. If you do not have a back-up
copy, you must submit a new application.
C-16 Why
is it important to make a back-up copy of my Hongkong
Post e-Cert certificate?
If you lose your certificate, and you do not
have a back-up copy, you will lose access to all
your old encrypted messages (as you will not have
your private key which you need to decrypt these
messages). It is absolutely essential, therefore,
that you make a back-up copy of your certificate.
C-17 Can
I use one Hongkong Post e-Cert certificate for
multiple e-mail addresses?
Currently very few common browsers are capable
of recognising multiple e-mail addresses on a
single certificate. Therefore, Hongkong Post CA
is adopting a policy of one e-mail address per
certificate.
C-18 What
are the authentication procedures for Hongkong
Post e-Cert certificates?
Details of authentication procedures are available
from the Hongkong Post Certification Practice
Statement at www.hongkongpost.gov.hk.
C-19 Why
is Hongkong Post issuing digital certificates
to minors?
It is the vision of Hongkong Post to groom the
younger generation to participate in secure electronic
transactions and communications. If a certificate
holder is a minor at the time of submitting his/her
application, it will be shown on the certificate
as "Hongkong Post e-Cert (Personal/Minor)". Relying
parties are reminded that minors are not legallycapable
of entering into contracts, and any such dealings
may be declared null and void in the future.
C-20 Can
I search Hongkong Post e-Cert (Encipherment) Certificate
from the Hongkong Post directory server ?
Absolutely. Like other types of e-Cert, the e-Cert
(Encipherment) Certificate will also be posted
to the directory for public searching.
C-21 Where
I can find the terms and conditions governing
the use of Hongkong Post e-Cert certificates?
The Subscriber Agreement and the Certification
Practice Statement, which can be obtained at any
Post Office counter, show all details of the terms
and conditions governing the use of Hongkong Post
e-Cert certificates . The Certification Practice
Statement can also be viewed at Hongkong Post
CA web site at www.hongkongpost.gov.hk.
C-22 How
to Search in Netscape the Certificate of Other
People Who Has Two Or More e-Cert With The Same
Email Address?
You have to specify the directory entry of Hongkong
Post e-Cert Directory with more Distinguished
Name (DN) information in the search field. An
example of it is by entering "OU=0000920170,O=Hongkong
Post e-Cert (Personal),C=HK" in the search root
field to limit the search to e-Cert (Personal)
and SRN=0000920170. For details, you may refer
to the user
guide of setting search field for the directory
entry of Hongkong Post e-Cert Directory.
C-23
Why must an applicant for e-Cert complete the
identity verification process in person at a post
office?
e-Cert is a digital certificate that offers a
safe and secure way to conduct online transactions.
In processing an e-Cert application, Hongkong
Post is required to verify the identity of the
applicant. As a procedural safeguard in the interest
of the applicant, it is necessary for the applicant
to visit a post
office to complete the face-to-face identity
verification process and delivery of the PIN envelope
before an e-Cert can be issued.
C-24
Can an applicant visit a post office during lunch
break, over weekend or on Sunday to complete the
application process?
Yes. All post offices will stay open during lunch
hours. As for the General Post Office at Central
and the Tsim Sha Tsui Post Office, public services
are available on Saturday afternoon and on Sundays
from 9:00 a.m. to 2:00 p.m. The opening hours
of the post offices can be found at Hongkong Post's
web site http://www.hongkongpost.gov.hk/product/e-Cert/office/index.html.
C-25
If an applicant has questions of installing an
e-Cert, how can he/she seek help?
He/she can call the e-Cert Hotline at 2921 6633.
C-26
Is it a proper arrangement for Hongkong Post to
deliver the e-Cert floppy disk /e-Cert File Card
to an applicant by post?
Hongkong Post always place emphasis on the security
aspects of e-Cert. Delivering the e-Cert floppy
disk / e-Cert
File Card by post is to save the applicants
from making an additional visit to the post office
to collect the e-Cert floppy disk / e-Cert
File Card. As a security measure, the delivery
of the e-Cert floppy disk / e-Cert
File Card is made by recorded delivery which
requires the applicant to sign for the receipt
of the e-Cert floppy disk / e-Cert
File Card. Furthermore, the use of an e-Cert
requires a PIN, which is given to the applicant
at the time of application.
C-27
Can an e-Cert be used on computers running Linux
or Mac operating systems?
e-Cert can be used on the Windows operating system.
The use of e-Cert on Linux and Mac operating systems
will require installation of additional software
plug-ins. You may contact the respective vendors
of the Linux and Mac system for the details of
the software plug-ins.
D.
Submission of Certificate Signing Request (CSR)
for e-Cert (Server)
D-1 What is a Certificate Signing Request (CSR)?
A Certificate Signing Request (CSR) is a request generated by your server which
contains the information of your organisation
and your public key. The Hongkong Post CA will
generate your e-Cert (Server) based on your CSR.
D-2 How do I generate a Certificate Signing Request (CSR)?
You may refer to the User Guides for e-Cert (Server) Applicant for the procedures
on how to generate a base64 encoded PKCS#10 CSR.
Please make sure that the correct domain name
(e.g. www.example.com) is entered in the "Common Name" field and "HK" in the "Country" field.
D-3 What should I paste into the Certificate Signing Request (CSR) text box during
the e-Cert (Server) CSR submission process?
You should paste the entire content of the CSR including the lines "-----BEGIN NEW CERTIFICATE REQUEST-----" and "-----END NEW CERTIFICATE REQUEST-----" into the Certificate Signing Request (CSR) text box.
D-4 What should I do if I did not download my e-Cert (Server) in the last step
of the Certificate Signing Request (CSR) submission
process?
You
can download your e-Cert (Server) from the Search
and Download Certificate web page after a successful CSR submission process.
E. Central Key Generation Service
for e-Cert
E-1 What
is Central Key Generation Service and how does
it work?
Hongkong Post generates the key pair (including
the Private key and Public Key) of an e-Cert on
behalf of the Subscriber and create the e-Cert.
The key generation and e-Cert creation process
is performed in a trustworthy manner and environment
within Hongkong Post's premises to ensure that
the key pair and e-Cert is not tampered with.
The generated key pair and e-Cert will be protected
by the Subscriber's own password and stored as
an e-Cert file either in a floppy disk or a e-Cert
File Card. The floppy disk / e-Cert
File Card will be delivered to the Subscriber
by registered mail. The Subscriber is required
to open the e-Cert file by the password distributed
to the Subscriber separately.
E-2 Is Central
Key Generation Service applicable to all types
of e-Cert?
The Central Key Generation Service is applicable
to e-Cert (Personal), e-Cert (Organisational)
and e-Cert (Encipherment) certificates. Subscribers
who opt for this service should make the request
and specify the collection/delivery arrangement
at the time of application.
E-3
Are there any protective measures to safeguard
the private key of the e-Cert created under the
Central Key Generation Service?
Hongkong Post does NOT keep copy of the private
key. The floppy disk / e-Cert
File Card containing the e-Cert and the key
pair is protected by a 16-digit PIN which is separately
handed-over to the subscribers at the time of
application. This PIN will also be required when
importing the e-Cert into the Internet browser
by the subscriber.
E-4
Which versions of Internet browser can the e-Cert
file generated under the Central Key Generation
Service work with?
The following are some common Internet browsers that are known to work with the
e-Cert file generated under the Central Key Generation
Service:
- Microsoft
Internet Explorer 5.01 with 128-bit High Encryption
Pack
- Microsoft Internet Explorer 5.5 or above
- Mozilla Firefox 2.0 or above
- Netscape Navigator 4.08 / Communicator 4.5 - 4.8
- Netscape Navigator 7.0 or above
E-5
Is there any tool or program that can be used
to change the password of the e-Cert file?
For a quicker and easier way in changing the
password of the e-Cert file, a "Change
Password Program" is available for downloading
from Hongkong Post CA web site. After downloading
and simple installation, the program can then
be ready for use.
E-6
Is there any restriction in using the "Change
Password Program" software?
The "Change
Password Program" software is designed for
use by the Subscribers of Hongkong Post e-Cert
in changing the password of the e-Cert file that
is created and saved on a floppy disk or other
storage media. It can only work in MS Windows
95 / 98 / ME / NT 4.0 / 2000 / XP / Vista platform.
E-7
How does the "Change Password Program" work?
The "Change
Password Program" is a window-based software.
It can facilitate the Subscriber to change the
password of the e-Cert file easily. If successful,
the e-Cert file in the floppy disk / other storage
device will embed with the new password.
F. Technical Issues
F-1 System
Requirements
The minimum system requirements are:
- Pentium 133 or above (or compatible) with
32 MB RAM
- Windows 95, Windows 98 or Windows NT
- Netscape Navigator 4.08 / Communicator 4.5
(or above) or Microsoft Internet Explorer 5.01
with 128 bit high encryption (or above)
- Hard disk free space : 100 MB
F-2 How
do I know that my Hongkong Post e-Cert certificate
is properly installed?
For Netscape Users:
- Open your Netscape browser;
- Click on the security icon (the one that looks
like a padlock) from the main toolbar;
- Select Certificates > Yours from
the menu on the left. Verify that your new e-Cert
is listed in the personal certificates display.
- To view your e-Cert particulars, select it
(e-Cert) and then click the 'view' button.
F-3 What
should I do if my PIN does not appear to work?
You must type the PIN correctly, making sure
that:
- the PIN includes all 16 digits,
- there are no spaces before, after, or within
the PIN
If the problem persists, please contact the Hongkong
Post CA Enquiry Hotline at 2921 6633.
F-4 Why
I am getting an 'Expired Certificate' message
shortly after downloading it?
This could happen because the system time of
your PC is slower than that of our CA system.
Our CA system uses the Global Position System
(GPS) clock to stamp the certificate. To avoid
this, all you need do is to wait for a while or
correct your system clock.
F-5 I have
deleted my Netscape Navigator and installed the
latest version. How do I reinstall my digital
certificate?
If you have removed your old copy of Netscape
Navigator, you have also deleted the file that
contains the private key associated with your
e-Cert. Without that private key or a back-up
copy, you cannot reinstall your e-Cert. You need
to apply for a new one. Upgrading Navigator by
using the Netscape installer preserves your personal
information, including your e-Cert and private
key.
F-6 How
do I know I am connected to a secure server ?
Upon accessing a server secured with a Hongkong
Post e-Cert (Server) certificate, the user will
see a padlock at the bottom of his or her Internet
Explorer browser or on the main toolbar of the
Netscape browser. Clicking on the padlock will
cause the details of the server's certificate
to be displayed.
F-7 How
do I get 128-bit / full-strength sessions?
Firstly, when you hear people speak of a 128-bit
or 40-bit connection, they are referring to the
"session key". This is a symmetric key created
by the browser when it connects to the server
that is used to encrypt AND decrypt data (transmitted
to and from the server) after the initial browser/server
"handshake". If your server supports full-strength
sessions and the browser connecting to your site
supports 128 bits, then a 128-bit session key
will be created and used. Browsers that have been
exported from the United States are limited to
creating 40-bit session keys. Browsers that have
been distributed within the US or manufactured
by companies outside the US can create 128-bit
session keys and thus connect to similarly manufactured
and distributed servers in full-strength crypto.
Outside the US, certain financial institutions
and governmental organisations can apply for a
Global Server Certificate, sometimes referred
to as a "Step-up Server Certificate". Having one
of these certificates installed on a server will
guarantee a 128-bit connection with any browser,
regardless of whether it is an "export" or "domestic"
version.
F-8 What
domain name do I use on my server certificate
request?
Please be careful when choosing your domain name.
You cannot change this information after the certificate
is issued. The domain name should be the exact
server name where the certificate will be installed.
When a browser connects to your server, it will
match the domain name to that on the certificate.
If the names do not match, the browser will return
an authentication error.
F-9 Which
field inside the e-Cert (Encipherment) certificate
controls the usage purpose of the key pair?
The "Key Usage" extension field specifies the
usage of the key pair. For e-Cert (Encipherment),
only the "Key Encipherment" bit and "Digital Signature"
bit are set.
F-10 What
is the usage of e-Cert (Encipherment)?
e-Cert (Encipherment) certificates are to be
used only:
- to send encrypted electronic messages to the
Subscriber Organisation;
- to permit the Subscriber Organisation to decrypt
messages; and
- to permit the Subscriber Organisation to acknowledge
receipt of the encrypted message by sending
an acknowledgement with a digital signature
added to it to confirm the identity of the receiving
Subscriber Organisation.
Further, digital signatures generated by this
class of certificate are only to be used to acknowledge
the receipt of electronic messages in transactions
which are not related to or connected with the
payment of money on-line or the making of any
investment on-line or the conferring on-line of
any financial benefit on any person or persons
or entities of whatsoever nature and under no
circumstances are digital signatures generated
by these certificates to be used to acknowledge
the receipt of messages sent in connection with
the negotiation or conclusion of a contract or
any legally binding agreement.
F-11 Using
e-Cert in the Crypto Tools software
The Crypto Tools (the Software) previously provided
by the former i-Security Solutions Limited (the
Company) has become unavailable for sales and/or
distribution after the Company closed down in
2003. If you are using the Software for signing
and encrypting documents with Hongkong Post e-Cert,
you should note that Hongkong Post shall not
accept
any claims or liabilities whatsoever arising
from the use or distribution of the Software.
G. Revocation of Certificates
G-1 How
do I revoke my Hongkong Post e-Cert certificate?
A subscriber may submit a request to revoke her/his
certificate at any time for any reason.Revocation
requests can be made by the following methods:
- Sending a certificate revocation request by
fax to 2775 9130 and the original of the revocation
request by post.
- Sending a certificate revocation request by
letter to Hongkong Post CA, PO Box 68777, Kowloon
East Post Office.
- Sending a digitally signed e-mail to enquiry@hongkongpost.gov.hk
- Showing a revocation request in person at
any post office with the same signature as on
the original application form.
Suspensions and revocations of certificates will
be effective only after they have been published
in the Certificate Revocation List (CRL).
Personal Certificate Revocation Request
A personal certificate can only be revoked by
the subscriber of that certificate.
Organisational Certificate Revocation Request
can be revoked by :
- A person nominated as an Authorised Representative
for the organisation, whose signature appears
on the application form as the authorised signature
at the time of application, or;
- The person whose name appears on the certificate
as the subscriber of that certificate.
Server e-Cert Revocation Request
A server certificate can be revoked by a person
nominated as an Authorised Representative for
the organisation, whose signature appears on the
application form as the authorised signature at
the time of application.
Encipherment e-Cert Revocation Request
An encipherment certificate can be revoked by
a person nominated as an Authorised Representative
for the organisation, whose signature appears
on the application form as the authorised signature
at the time of application.
Acknowledgement to the Subscriber/Authorised
Representative
Based on a request by fax, Hongkong Post will
place a "Hold" on the certificate, which effectively
suspends, but does not revoke the certificate.
The subscriber then has to send his/her original
of the revocation request to Hongkong Post to
complete the revocation process. In-person or
digitally signed requests will be processed directly
as immediate revocations without the "Hold" procedure.
Hongkong Post will endeavour to issue a Notice
of Revocation to such subscribers within one week
following the request for revocation.
Business Hours for Processing Revocation
Requests
Monday to Friday 9:00 a.m. to 5:00 p.m.
Saturday 9:00 a.m. to 12:00 noon
Sundays & Public Holidays 9:00 a.m. to 12:00
noon
On any weekday on which a tropical cyclone warning
signal no. 8 (or above) or a black rainstorm warning
signal is hoisted, Hongkong Post Certificate Authority
will open at the usual time if the signal is lowered
at or before 6 a.m. that day. If the signal is
lowered between 6 a.m. and 10 a.m. or at 10 a.m.,
Hongkong Post Certificate Authority will open
at 2:00 p.m. on any weekday, other than on a Saturday,
Sunday and public holiday.
Service Pledge and Certificate Revocation
List Update
- Hongkong Post will exercise reasonable endeavours
to see that within 2 working days of (1) Hongkong
Post receiving a revocation request from the
Subscriber or (2) In the absence of such a request,
the decision by Hongkong Post to suspend or
revoke the certificate, the suspension or revocation
is posted to the Certification Revocation List.
- However, a Certificate Revocation List is
not published in the directory for access by
the public following each certificate revocation.
Only when the next Certificate Revocation List
is updated and published will it reflect the
revoked status of the certificate. [Certification
Revocation Lists are published daily and are
archived for 7 years.]
For the avoidance of doubt, all Saturdays, Sundays,
public holidays and for all weekdays on which
a tropical cycle and rainstorm warning signal
is hoisted, are not working days.
G-2 Why
do I need to revoke my certificate before it expires?
We strongly recommend that you revoke (cancel)
your certificate if you suspect that your private
key has been compromised, or you no longer wish
to participate in the Hongkong Post Public Key
Infrastructure.
G-3 How
can I verify the status of my revoked certificate?
You can verify the status of your revoked Hongkong
Post e-Cert certificate by pulling down the entire
Hongkong Post CA Certification Revocation List
(CRL) from the directory server at ldap.hongkongpost.gov.hk,
which is updated everyday. The CRL on the directory
server can only be read by using the LDAP protocol
and you need a client software with LDAP capability,
for example, the Crypto Tools bundled in the e-Cert
Customer Kit. Alternatively, you can go to our
web site and access the CRL at the following URL
: http://crl1.hongkongpost.gov.hk/crl/e-CertCA1CRL1.crl.
For users of Microsoft Windows with Internet Explorer
5.0 or above, when your open the CRL file, there
will be a CRL pop up screen showing the list of
revoked certificates in certificate serialnumber
order. You may then locate the certificate by
the certificate serial number. Please note that
the revocation status of expired certificates
will not be published in CRL.
H. Deletion and Recovery issues
H-1 Is there
any way to recover my Hongkong Post e-Cert certificate
if my hard drive has crashed?
A hard drive crash may delete the certificate
in your computer. Once it has been lost, there
is no way to retrieve it. You will first need
to revoke your certificate, then enrol for a new
one. You may also restore your back-up copy and
import this copy into your browser.
H-2 What
should I do if my computer has been stolen together
with my certificate?
As your digital certificate is protected by a
password, it is unlikely that anyone else will
be able to use it to impersonate you. However,
we strongly advise you to revoke your certificate
immediately if your computer has been stolen and
then enrol for a new one.
H-3 Should
I delete my expired or revoked e-Cert?
You should not delete your expired or revoked
e-Cert. By deleting a certificate, you will no
longer have access to the public key associated
with it and it will therefore no longer be possible
to read encrypted messages with it.
I. Back-up and transfer of certificate
I-1 How
do I save a back-up copy of my digital certificate?
Each browser has its own back-up procedures.
For Netscape Users :
- Click on the security icon (the one that resembles
a padlock) from the main toolbar,
- Select Certificates > Yours from
the menu on the left,
- Select the e-Cert you intend to save and click
Export,
- You will be prompted to choose a transport
password which you will be asked for when importing
or opening this copy of your e-Cert. Click OK,
- Select a location (such as your floppy disk)
and file name in which to save your e-Cert.
Click Save,
- Protect your floppy disk or other media and
your transport password in a secure manner.
For Internet Explorer Users:
- In your Internet Explorer browser, Click Tools
from the pull-down menu and select Internet
Options.
- In the Internet Options window, click
on the tab Content and select Certificates.
- Select the Personal tab and click on
the certificate to be exported. Then click on
Export button.
- The Certificate Manager Export Wizard pops
up. Read the information provided therein and
click on Next button.
- Now you have to indicate if you want to export
the private Key with your certificate. Select
Yes, export the private key and click
the Next button.
- Check the option Include all certificates
in the certification path if possible.
- Uncheck the option Enable strong protection
(requires IE 5.0, NT 5.0 or above) if you
will use the exporting file on applications
other than IE 5.0 or above.
- Click the Next button.
- Type in a password no less than 8-character
length (you may select a new password if you
wish) to protect the .PFX file. Then click Next
- You must now decide where to save the .PFX
file. Locate and choose a directory for this
file. Type a friendly name in the File
name box. Click Next.
- In the popup, Export Wizard Window, Click
Finish.
- Export is complete and click OK button.
I-2 How
do I transfer my digital certificate to a new
computer?
The first step for transferring your e-Cert is
to save ("Export") it from the computer's hard
drive onto a floppy disk or other transfer medium.
When your e-Cert has been successfully exported,
you can then import it into the new computer.
To import your e-Cert into Netscape Navigator
:
- Click on the security icon (the one that looks
like a padlock) from the main toolbar,
- Select Certificates > Yours from
the menu on the left,
- Select Import,
- You will then be prompted to give the password
you will use to protect your e-Cert,
- Locate your e-Cert from the floppy disk or
other medium used to back up your e-Cert (it
should have a .p12 extension). Highlight it
and click Open,
- Enter your transport password and click OK.
To import your e-Cert into Internet Explorer
:
- In your Internet Explorer browser, Click Tools
in the pull down menu and select Internet
Options.
- In the Internet Options window that
pops up, click on the tab Content
and select Certificates.
- Select the Personal tab and Click
on Import button.
- The Certificate Manager Import Wizard pops
up. Read the information provided therein and
click on Next button.
- You have to select the file to be imported.
Click on Browse button and select the location
and filename to be imported. If you are importing
PKCS#12 certificate file produced by e-Cert
Central Key Generation, or exported from other
applications which use .P12 file extension,
you need to click the Browse button,
change the Files of type to All Files
(*.*) in the Open window and then select
the required .P12 file.
- Click Next button. The system will
then prompt you to enter the password. The password
used while exporting the file has to be used
here. Check on box Enable strong private
key protection. If you want to export the
certificate sometime in the future, check on
box Mark the private key as exportable
as well.
- Key in the password and click Next
button.
- Selecting a store for the Certificate : Select
the first option for the system to Automatically
select the certificate store based on the type
of certificate. Click on the Next
button.
- The Certificate Manager Import Wizard finishing
screen appears. Click on the Finish button.
The Private Key Container screen will
appear. Microsoft Internet Explorer stores your
key pair and e-Cert Certificate details in the
Private Key Container. Hence in the following
steps, you are required to choose the security
level and provide a profile/username and password
to be stored for identification and access permissions.
- Click Set Security Level button.
- Select High security level (default
set to medium). Click Next button.
- The Private Key Container window now seeks
a password to protect the key pair.
- If any profiles are created earlier, you may
select the option Use this password to access
this item and select the appropriate profile
from the dropdown list.
If you are using a newly installed Microsoft
Internet Explorer or if you have not created
any profile before, select the option Create
a new password for this item and key in
a name and password for the new profile.
- Click Finish button.
- Key in the Private Key Container password
again and click OK button.
- If the PKCS#12 file contains the Root CA certificate,
a pop-up window will be displayed to re-confirm
the storing of the Hongkong Post Root CA certificate
in the Root Store of Internet Exporer. Click
Yes to continue. This window will not
pop up if the root CA certificate has already
been installed in the browser.
- Click on OK button and close the Certificate
Manager wizard and the Internet Options
windows.
Note: Please make sure that you have successfully
imported the certificate to the new machine before
deleting the old certificate and the transient
file.
J. e-Cert for Smart ID Card / Card
Reader
J-1
What types of smart card reader can support the
usage of e-Cert on Smart ID Card ?
The Smart Card Reader should be able to support
the following features in order to support the
usage of Smart ID Card:
Mandatory features
| Feature |
Mandatory Requirement |
| Smart Card Interface Standard |
ISO7816 |
| Software Bundled |
PC/SC Driver |
Desirable features
| Feature |
Desirable Requirement |
Remarks |
| Type of card contact |
Landing contact
(下落接觸式) |
Landing contact type is
desired in view of the protection it can provide
to the Smart ID Card which is expected to
last for at least 10 years. |
| Software interface standard |
Europay,
Mastercard and Visa (EMV) |
EMV is desired in consideration
of its capability for supporting potential
electronic payment applications. |
For more details, please visit the Smart ID Card
web site at http://www.smartid.gov.hk.
J-2
Where can I buy these Smart Card Readers?
You may order a compatible Smart Card Reader from
Hongkong Post's online shop "ShopThruPost".
J-3
How to install the Smart Card Reader into my computer?
You may follow the Installation Guide provided
by the Smart Card Reader vendor for details. The
Installation Guide is normally attached to the
box set of the Smart Card Reader upon purchase.
J-4
Would the Smart Card Reader scratch the SIM on
my Smart ID Card?
To prevent damage to the Smart ID Card, Smart
Card Reader of landing contact type (下落接觸式) is
suggested in view of the protection it can provide
to the Smart ID Card which is expected to last
for 10 years.
J-5
What is the minimum requirement of my PC to install
a Smart Card Reader?
It depends on the reader you have purchased.
However, your PC must have a communication interface
such as a serial port, a USB port or a PCMCIA
slot (which depends on the reader purchased) to
connect with the reader.
J-6
What if the chip of my Smart ID Card scratched?
Would the e-Cert inside my Smart ID Card be affected?
As long as your e-Cert on the Smart ID Card can
be accessed by keying in your e-Cert PIN, scratches
on the surface of the chip should not affect your
e-Cert on the ID card.If scratches appear on the
chip of your Smart ID Card and you cannot access
the data and e-Cert stored on your Smart ID Card,
your card chip may be damaged and you may apply
for a replacement through the Immigration Department.
J-7
What if my Smart ID Card is damaged and my e-Cert
cannot be accessed?
You should report loss of your smart ID card
to the Immigration Department at one of its Registration
of Persons Offices. You may also submit request
to Hongkong Post Certification Authority to revoke
your e-Cert. After your collection of a new
smart ID card from the Immigration Department,
you may apply for a new e-Cert at any of the
20 Designated Post Offices , and have your
e-Cert embedded in your smart ID card.
J-8
How many e-Certs can be stored in a smart ID card?
Each smart ID card can store one active e-Cert
with its corresponding key pair. Whenever you
load
a new e-Cert to your smart ID card, the existing
e-Cert on the ID card will be replaced while its
corresponding private key may continue to reside
on the card. Each smart ID card can store three
old private keys while the corresponding e-Cert(s)
may be stored in your computer or a floppy disk.
J-9
What should I do if I lost my smart ID card with
e-Cert or accidentally deleted e-Cert?
You should report loss of your smart ID card
to the Immigration Department at one of their
Registration of Persons Offices. You may also
request Hongkong Post to revoke your e-Cert by
submitting
a revocation request. If you have purchased
a backup e-Cert floppy disk / e-Cert
File Card when you apply for the e-Cert on
smart ID card and you decide not to revoke your
e-Cert, you can continue using your e-Cert on
the floppy disk / e-Cert
File Card. If you do not have a backup e-Cert
floppy disk / e-Cert
File Card, you may apply for a new e-Cert
but you have to pay the prescribed subscription
fee.
J-10
Where can I check the information of the e-Cert
on my smart ID card if I do not have Smart Card
Reader at home?
You may check the information of your e-Cert
at public computers with Smart Card Readers installed.
J-11
For how long is the Hongkong Post e-Cert on smart
ID card valid?
- Each Smart ID e-Cert has a lifespan of 3 years.
The first batch of Smart ID e-Cert was issued
in June 2003, and will become invalid when their
3-year lifespan start to expire in June 2006.
- If your Smart ID e-Cert is issued on or before
31.3.2006, you will still enjoy free use of
your e-Cert until 31.3.2007 or end of its 3-year
lifespan, whichever date is earlier.
- Smart ID e-Cert to be issued on or after
1.4.2006 will still have a free use period of
one-year.
J-12
If the e-Cert on Smart ID Card is expired, how
can I decrypt emails encrypted with my expired
e-Cert?
Each Smart ID Card can store one valid e-Cert
with its corresponding key pair and 3 archived
private keys of your expired e-Cert(s). You may
use the archived private keys to decrypt the emails
encrypted with your expired e-Certs.
J-13
How can I delete the e-Cert on my Smart ID Card?
If you delete the e-Cert on your Smart ID Card,
the corresponding private key will also be deleted.
You can do so on your own by using your Smart
Card Reader together with the e-Cert
Control Manager software. Please note that
you will not be able to recover the e-Cert and
private keys deleted from your smart ID card.
J-14
What is the usage of the PIN Envelope? Why are
there 2 PINs of different length?
The PIN Envelope contains 2 e-Cert PINs each
with different number of digits.The 8-digit PIN
allows you to access the e-Cert on your Smart
ID Card while the 16-digit PIN enables you to
access the e-Cert stored on the backup e-Cert
floppy disk / e-Cert
File Card.
J-15
What should I do if my e-Cert PIN of the Smart
ID Card becomes invalid?
Please send us a written request for resetting
the PIN of e-Cert on Smart ID Card and
download the application form. The completed
form could be submitted by fax at 2775 9130, or
mail to "Kowloon East Post Office P.O. Box
68777". After verification of the request,
Hongkong Post will send you a new PIN envelope
and arrange to reset your e-Cert PIN at a designated
post office.
J-16
Should I revoke the e-Cert if either one PIN is
disclosed to other persons?
Without revoking your e-Cert, you should change
the e-Cert PIN on your smart ID card or your backup
e-Cert floppy disk or e-Cert
File Card (if any) immediately. If you lost
your Smart ID Card and/or backup e-Cert floppy
disk or e-Cert
File Card (if any) together with your e-Cert
PIN, you should request Hongkong Post to revoke
your e-Cert immediately (see Question 22 for the revocation procedures) in order to protect your
own interest.
J-17
What is the usage of the Back-up e-Cert Floppy
Disk / e-Cert File Card?
For security reasons, the embedded e-Cert cannot
be retrieved from the smart card. The cardholder
will not be able to recover the e-Cert including
the private key in case the card is lost or damaged.
As such, Hongkong Post will offer to the cardholder
an option to have a backup copy of his e-Cert
and private key embedded on the Smart ID Card
on a floppy disk or a e-Cert
File Card on a floppy disk by the time he
submit an e-Cert application. The backup e-Cert
floppy disk / e-Cert
File Card will be delivered to your address
by Recorded Delivery service.
J-18
If I have a Hongkong Post e-Cert stored on floppy
disk / e-Cert File Card and I have not applied
for an e-Cert on the smart ID card, can I have
my existing e-Cert embedded onto my smart ID card?
e-Cert stored on floppy disk / e-Cert
File Card cannot be loaded onto the smart
ID card. You may apply for a new e-Cert to be
embedded onto your smart ID card.
J-19
Under what circumstances should I revoke my e-Cert
on the Smart ID Card?
You should request HKPost to revoke your e-Cert
if you wish to terminate the validity of your
e-Cert when :-
- someone else is suspected to have possessed
both your Smart ID Card and your e-Cert PIN;
- someone else is suspected to have possessed
both your e-Cert backup floppy disk / e-Cert
File Card and your 16-digit e-Cert PIN;
- Your smart ID card and/or e-Cert backup floppy
disk / e-Cert File Card is lost.
J-20
Can I resume the revoked e-Cert on the Smart ID
Card?
Once revoked, the e-Cert cannot be resumed. You
have to apply for a new e-Cert for usage.
J-21
Any cost for revocation of my e-Cert?
Hongkong Post will not charge you extra cost
for e-Cert revocation service.
J-22
How can I revoke my e-Cert?
You can request revocation of your e-Cert by
one of the following means:-
- Submit an on-line
e-Cert Revocation Form.
- Submit an e-Cert Revocation Form by fax to
HKPost at 2775 9130
- Submit an e-Cert Revocation Form by mail to
:- Kowloon East Post Office Box 68777.
- Submit an e-Cert Revocation Form at the HKPost
Drop Box located at Immigration Department's
Registration of Persons Offices where you report
loss of your ID card.
J-23
How can I prevent others from accessing the e-Cert
information on my smart ID card? Would my information
be leaked to others if I lost my smart ID card?
You should keep your smart ID card in safe custody
and not to disclose the e-Cert PIN (Personal Identification
Number) to other persons. In case you lose your
ID card but your e-Cert PIN is not known to anyone
other than yourself, others should not be able
to access your e-Cert even they hold your smart
ID card.
J-24
Can I gain access to e-Cert and private key stored
on others' Smart ID Cards?
No, you cannot access the e-Cert and private
key stored on others' smart ID cards without the
respective e-Cert PIN.
J-25
What is e-Cert Control Manager Add-on Pack and
do I need to install it?
e-Cert Control Manager Add-on Pack provides
an enhanced PKCS#11 module for interfacing with
e-Cert on Smart ID Card. As some of the e-Cert
applications may use this enhanced PKCS#11 module,
you can enjoy more e-Cert applications by installing
e-Cert Control Manager with Add-on Pack.
If the e-Cert Control Manager Add-on Pack is not yet installed (see Question
27 for checking the installation of e-Cert Control
Manager Add-on Pack), you may consider downloading
and installing the current version of e-Cert
Control Manger for your operating system. The
e-Cert Control Manger Add-on Pack is included
in the current version of e-Cert Control Manager
installation program.
J-26
Where can I obtain e-Cert Control Manager Add-on
Pack?
e-Cert Control Manager Add-on Pack is included
in the e-Cert
Control Manager installation program. You
may download and run the e-Cert Control Manager
installation program to install both e-Cert Control
Manager and Add-on Pack.
J-27
How do I know that e-Cert Control Manager Add-on
Pack is installed?
e-Cert Control Manager Add-on Pack is installed by default in version 2.1.8 Build
6 of e-Cert Control Manager.
If the version of e-Cert Control Manager is 2.1.6
Build 18 and e-Cert Control Manager Add-on Pack
is installed, you can access the Add-on Pack
Readme through the "Start > Programs > Hongkong
Post e-Cert > Add-on Pack 1 Readme" shortcut. Alternatively, you can find e-Cert Control Manager Add-on Pack in
the "Control Panel > Add/Remove Programs" installed program list.
In case you do not know the version of e-Cert
Control Manager you are using, please read
the tips on checking version of e-Cert Control
Manager.
J-28
Will e-Cert Control Manager support Netscape
Navigator version 9 or above?
Due to the change in Netscape Navigator architecture starting from version
9, the browser is no longer compatible with e-Cert
Control Manager. Therefore, e-Cert Control Manager
has ceased to support Netscape Navigator version
9 or above. Alternatively, you may wish to use
Mozilla Firefox. For details, please refer to
the User Guides for Mozilla Firefox.
J-29
Why I still cannot use e-Cert on Smart ID Card
in certain online services through Internet Explorer
on Windows Vista even I have installed e-Cert
Control Manager for Windows Vista?
For certain online services that have system requirement of using Java Runtime
Environment (JRE), there is a known interface
problem between JRE (prior to JRE 6 Update 10)
and Internet Explorer 7 on Windows Vista platform
that may affect the access of e-Cert on Smart
ID Card through the e-Cert Control Manager. To
use those online services, you need to have JRE
6 Update 10 or above installed. If you encounter
problems in using e-Cert on Smart ID Card in
these particular online services, you may wish
to contact the respective service providers for
details.
J-30
What should I do if I encounter error messages
during the installation of e-Cert Control Manager?
Please contact our Customer Services Hotline at 2921 6633 and provide the error
messages.
K. Renewal of e-Cert (Personal)
K-1 Why
subscribers of e-Cert on Smart ID Card have not
received the renewal notice upon the expiry of
e-Cert?
When the subscriber has not provided his/her
e-mail address to Hongkong Post Certification
Authority (HKPost CA) or changed it without notifying
HKPost CA, HKPost CA is not able to issue the
notice through e-mail. If subscribers wish to
check whether his/her e-Cert is due for renewal,
they can call our customer service hotline at
29216633, or send us an e-mail to enquiry@hongkongpost.gov.hk
or visit any one of the 20
designated post offices.
K-2
What is the difference between "Extension
of Subscription Period" and "Renewal"?
"Extension of Subscription Period"
– The e-Cert (Personal) is physically valid for
three years and its subscription period is one
year. Upon the expiry of the subscription period,
subscribers need to pay HK$50 per certificate
per year to extend the subscription period. If
not, Hongkong Post will inactivate their e-Cert
by suspension or revocation. According to the
Electronic Transactions Ordinance, the inactivated
certificates will be included in the Certificate
Revocation List (CRL) published on Hongkong
Post web site. After the subscribers extended
the subscription period, they still can use the
existing e-Cert and they will not be issued any
new e-Cert floppy disks / e-Cert
File Card or new PIN envelopes.
"Renewal" – The e-Cert (Personal)
is physically valid for three years. Upon the
expiry of the three years validity period, subscribers
need to renew their e-Cert and pay HK$50 for the
first year subscription fees. A new PIN envelope
will be issued to the subscriber.
K-3
How can subscribers renew their e-Cert?
Subscribers can either submit renewal application
online or by visiting post
offices. However, the renewal methods will
vary according to actual needs of different subscribers.
For details, you may refer to Renewal
of e-Cert.
K-4
What is the validity period of the renewed e-Cert
on Smart ID Card? What is the renewal fee?
The renewed e-Cert on Smart ID Card is physically
valid for three years and its subscription period
is one year. The subscription fee is HK$50 per
certificate per year including the charge for
a back-up floppy disk or a e-Cert
File Card.
K-5
Can I pay HK$150 for 3-yr subscription fees in
one go?
No. Subscription fees are charged on a yearly
basis upon the expiry of each subscription period.
K-6
When submitting a renewal application, will the
subscribers of e-Cert on Smart ID Card be issued
a new PIN envelope? If subscribers request for
a back-up floppy disk or a e-Cert File Card, do
they need to pay extra for the back-up floppy
disk / e-Cert File Card?
A new set of PIN envelope will be issued to the
subscribers upon renewal of certificate. If subscribers
request for a back-up floppy disk or a e-Cert
File Card when submitting a renewal application,
the renewal fees (i.e. the first-year subscription
fees of the renewed e-Cert) at HK$50 included
also the charges of back-up floppy disk / e-Cert
File Card.
K-7
Upon receipt of the new PIN envelope and floppy
disk / e-Cert File Card for the renewed e-Cert
on Smart ID Card, can the subscriber throw away
the old PIN envelope and floppy disk / e-Cert
File Card?
Subscribers should keep the PIN envelope for
the e-Cert once embedded in Smart ID Card and
its corresponding backup floppy disk / e-Cert
File Card in good custody. In the event when
they require to embed the renewed e-Cert in the
same Smart ID Card (once embedded with e-Cert
before), they still need to use either the 8-digit
PIN from the old PIN envelope or the changed password
to complete the process. The 8-digit password
on the new PIN envelope will not be applicable
in this case.
K-8
Can I renew my e-Cert on Smart ID Card but have
it loaded onto floppy disk / e-Cert File Card
only instead of Smart ID Card?
Subscribers can choose whether to embed the renewed
e-Cert onto the Smart ID Card.
K-9
Can the renewed e-Cert be stored together with
the existing e-Cert that was stored in the Smart
ID Card?
Each Smart ID Card can store one e-Cert only.
If subscribers choose to embed the renewed e-Cert
in the Smart ID Card, the existing e-Cert on Smart
ID Card will be replaced by the renewed one, with
the pair of keys remained at the Smart ID Card.
K-10
I have two e-Cert on hand but only the Smart ID
Card one was expired. Can I load the other e-Cert
(Personal) from floppy disk / e-Cert File Card
onto my Smart ID Card by myself?
Yes. For details, please refer to the user guide
on "How
to load e-Cert to Smart ID Card?".
K-11
What are the channels for enquiry?
Customers can call our customer service hotline
2921 6633 or send e-mail to enquiry@hongkongpost.gov.hk
or visit any one of the 20
designated post offices.
L. E-CERT FILE CARD
L-1
What is an e-Cert File Card?
e-Cert
File Card is a contact smart card which is
an alternative storage medium for Hongkong Post
e-Cert. It has the same size as a credit card.
As compared with the floppy diskette, e-Cert File
Card is more durable and smaller in size.
L-2
What is the difference between e-Cert File Card
and floppy diskette?
Both e-Cert
File Card and floppy diskette are storage
media of e-Cert. Floppy diskette requires floppy
diskette drive to access the e-Cert while e-Cert
File Card requires a compatible smart card reader.
e-Cert File Card has greater durability and smaller
in size as compared to floppy diskette. For the
e-Cert File Card, customer cannot write /update
any files to it. However, floppy diskette allows
customer to add more files to the diskette without
any restriction.
L-3
What is the difference between e-Cert File Card
and Smart ID Card?
e-Cert
File Card is just a storage medium for Hongkong
Post e-Cert. Customer can export their e-Cert
on the e-Cert File Cards to other storage media.
For security reason, customers are recommended
to keep their e-Cert File Cards in a safe place
after use. For Smart ID Card, customer can directly
use the embedded e-Cert to perform online transactions
but the Private Key of the e-Cert on the Smart
ID Card cannot be exported to other media.
L-4
What are the major benefits of an e-Cert File
Card?
Smart card is an advanced and reliable technology
mostly used in the commercial sector such as credit
card, security access control, Smart ID Card,
etc. The three major benefits of e-Cert File Card
are:
- e-Cert File Card is less susceptible to data
loss from environmental factor and human error.
- e-Cert File Card resembles a credit card
in size and shape.
- e-Cert File Card is durable and has a longer
life span.
L-5
Do I need to pay for the e-Cert File Card?
No. The e-Cert subscription fee has already included
the cost of a storage medium for the e-Cert file
which can either be an e-Cert
File Card or a floppy diskette. Therefore,
no additional charge is required for e-Cert File
Card.
L-6
In term of protection on the e-Cert, What is the
difference between Smart ID Card and e-Cert File
Card?
Both Smart ID Card and e-Cert File Card require
a password to use the private key of the e-Cert.
For e-Cert
File Card, the private key and public key
can be exported to other storage medium while
for Smart ID Card, the private key cannot be exported
to other storage medium.
L-7
How can I use my e-Cert from e-Cert File Card?
You are required to export the e-Cert from the
e-Cert File Card to your selected storage medium
(such as USB storage device, or other removable
storage media) by using an e-Cert
File Card Utility Program and have a compatible
smart card reader installed on your computer.
You may buy a compatible smart card reader at
Hongkong Post online shop "ShopThruPost".
To learn how to export your e-Cert, you may simply
refer to the user
guide of the e-Cert File Card Utility Program.
L-8
Can I change the e-Cert password on the e-Cert
File Card?
Yes. The e-Cert File Card Utility program enables
you to change the password of your e-Cert on the
e-Cert File Card. You may simply download e-Cert
File Card Utility program from our website
to change your e-Cert password with our step-by-step
user guide. Please note that only the e-Cert
password on your e-Cert File Card has been changed.
If you wish to change the e-Cert password on other
storage media, (such as USB storage device, or
other removable storage media) you may download
and use the Change
Password Program from our website. For details,
please refer to the user
guide of the Change Password Program.
L-9
How can I load the e-Cert on e-Cert File Card
to my Smart ID Card?
If your Smart ID Card has been embedded with
an e-Cert before, you can follow through the steps
below to load your e-Cert on e-Cert File Card
to the Smart ID Card.
- Download and install the e-Cert
File Card Utility Program from our website
to export
your e-Cert on e-Cert File Card to a storage
media (such as USB storage device, or other
removable storage media).
- Upon completion, you can download and install
the e-Cert
Control Manager to load your e-Cert to the
Smart ID Card. You may simply refer to the user
guide of the e-Cert Control Manager for
the detailed procedures.
Should you encounter any technical problem, please
feel free to contact our Customer Services Hotline
at 2921 6633.
L-10
Can I delete the e-Cert from the e-Cert File Card?
No, you cannot delete/add any files to the e-Cert
File Card.
L-11
If the e-Cert is already stored on my PC, can
I copy it back to the e-Cert File Card?
No, you cannot delete/add any files to the e-Cert
File Card.
L-12
My e-Cert File Card is damaged and my e-Cert cannot
be accessed. If this is the only copy of my e-Cert,
what should I do?
You may submit a request to Hongkong Post Certification
Authority to revoke
your e-Cert, and then apply
for a new e-Cert. You will need to pay for
the subscription fee as prescribed on the application
form.
L-13
Do I need to keep the e-Cert File Card after I
have exported my e-Cert?
Yes. You need to keep the e-Cert
File Card in a safe place after exporting
the e-Cert to another removable storage media.
In case your removable storage medium is corrupted
and can no longer be recovered, you can use your
e-Cert File Card to export your e-Cert to the
new removable storage medium.
L-14
What should I do if I forgot the password of my
e-Cert on the e-Cert File Card?
In case you have forgotten your password, you
are recommended to revoke
your e-Cert immediately and apply
for a new e-Cert. You will need to pay for
the subscription fee as prescribed on the application
form
L-15
What should I do if I lost my e-Cert File Card?
For security reason, you have to revoke
your e-Cert and apply
for a new e-Cert accordingly. You will need
to pay for the subscription fee as prescribed
on the application form.
L-16
What is the e-Cert File Card Utility Program?
e-Cert
File Card Utility Program is a software for
exporting your e-Cert from e-Cert File Card to
storage media (such as USB storage device, or
other removable storage media) and changing the
password of your e-Cert on e-Cert File Card. The
utility program can run on Windows 2000 / XP /
Vista.
L-17
How can I use the e-Cert File Card Utility Program?
You may refer to the Installation
and User Guide of the e-Cert File Card Utility
Program for detailed procedures at our website.
Should you have any enquiry, please contact our
Customer Services Hotline at 2921 6633.
L-18
What are the minimum requirements to operate the
e-Cert File Card?
You require a smart card reader and the e-Cert
File Card Utility program which run on Microsoft
Windows 2000 or XP or Vista.
L-19
What type of card reader can I use to read the
e-Cert File Card?
You can use the same smart card reader for both
e-Cert File Card and Smart ID Card. The smart
card reader should support ISO 7816 smart card
interface standard and software bundled with PC/SC
driver. You may visit Hongkong Post online shop
"ShopThruPost"
to purchase a compatible card reader.
L-20
How can I get an e-Cert File Card?
When you apply for a Hongkong Post e-Cert (except
server certificate) and select e-Cert File Card
as the storage medium for your e-Cert, you can
get your e-Cert File Card accordingly.
L-21
Can I select both floppy diskette and e-Cert File
Card for the e-Cert application?
No. You must choose either e-Cert
File Card or floppy diskette as the storage
medium of your e-Cert.
L-22
Will the floppy diskette option be removed in
the near future ?
No. Floppy diskette option will not be removed
in the near future.
|
